Debian 11 calibre DLA-4554-1 Path Traversal and File Write Risks

CVE-2025-64486

calibre does not validate filenames when handling binary assets in
FB2 files, allowing an attacker to write arbitrary files on the
filesystem when viewing or converting a malicious FictionBook
file. This can be leveraged to achieve arbitrary code execution.

CVE-2026-25635

Calibre's CHM reader contains a path traversal vulnerability that
allows arbitrary file writes anywhere the user has write
permissions.

CVE-2026-25636

a path traversal vulnerability in Calibre's EPUB conversion allows
a malicious EPUB file to corrupt arbitrary existing files writable
by the Calibre process

CVE-2026-26064

a path traversal vulnerability that allows arbitrary file writes
anywhere the user has write permissions.

CVE-2026-26065

Path Traversal through PDB readers that allow arbitrary file
writes with arbitrary extension and arbitrary content anywhere the
user has write permissions. Files are written in 'wb' mode,